ashb commented on code in PR #72262:
URL: https://github.com/apache/airflow/pull/72262#discussion_r3957723553
##########
providers/edge3/src/airflow/providers/edge3/worker_api/auth.py:
##########
@@ -30,21 +31,64 @@
InvalidSignatureError,
)
-from airflow.api_fastapi.auth.tokens import JWTValidator
+from airflow.api_fastapi.auth.tokens import JWKS, JWTValidator
from airflow.providers.common.compat.sdk import conf
log = logging.getLogger(__name__)
-@cache
-def jwt_validator() -> JWTValidator:
+def _trusted_jwks_url() -> str:
+ """Return the configured trusted JWKS URL, or an empty string when
unset."""
+ return conf.get("edge", "trusted_jwks_url", fallback="") or ""
+
+
+def _jwt_algorithms() -> list[str]:
+ """Return the accepted signing algorithms for OIDC worker tokens."""
+ configured = conf.get("edge", "jwt_algorithm", fallback="RS256") or "RS256"
+ return [algorithm.strip() for algorithm in configured.split(",") if
algorithm.strip()]
+
+
+def _jwt_audience() -> str | None:
+ """Return the expected token audience, or None to skip audience
verification."""
+ return conf.get("edge", "jwt_audience", fallback="") or None
+
+
+def _shared_secret_validator() -> JWTValidator:
+ """Build a validator for worker tokens signed with the shared ``[api_auth]
jwt_secret``."""
return JWTValidator(
secret_key=conf.get("api_auth", "jwt_secret"),
leeway=conf.getint("api_auth", "jwt_leeway", fallback=30),
audience="api",
)
+def _oidc_validator(jwks_url: str) -> JWTValidator:
+ """
+ Build a validator for worker tokens issued by a trusted OIDC provider.
+
+ Verifies the token signature against the provider JWKS and checks the
+ ``iss`` and (optionally) ``aud`` claims. Used when ``[edge]
trusted_jwks_url``
+ is configured, so workers can authenticate with tokens minted by an
+ external identity provider instead of the shared secret.
+ """
+ return JWTValidator(
+ jwks=JWKS(url=jwks_url),
+ issuer=conf.get("edge", "jwt_issuer", fallback=None),
+ audience=cast("str", _jwt_audience()),
+ algorithm=_jwt_algorithms(),
+ required_claims=frozenset({"iat", "exp"}),
+ leeway=conf.getint("api_auth", "jwt_leeway", fallback=30),
Review Comment:
I'm not saying either one is right or wrong.
Maybe we want `conf.getint("edge3", "jwt_leeway",
fallback=conf.getint("api_auth", "jwt_leeway", fallback=30),`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
